# Unexpected state reading file(cannot allocate memory)

**URL:** https://discuss.elastic.co/t/unexpected-state-reading-file-cannot-allocate-memory/209446
**Category:** Beats
**Tags:** filebeat
**Created:** [November 26, 2019, 8:35am UTC](https://discuss.elastic.co/t/unexpected-state-reading-file-cannot-allocate-memory/209446 "2019-11-26T08:35:43Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![msunilreddy](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@msunilreddy](https://discuss.elastic.co/u/msunilreddy)
#### Post date: [November 26, 2019, 8:35am UTC](https://discuss.elastic.co/t/unexpected-state-reading-file-cannot-allocate-memory/209446/1 "2019-11-26T08:35:43Z")

</div>

Hi,  
I am getting below error when I start filebeat. It was working fine from past one month. Suddenly my filebeat container exited with OOM killed error. I am using filebeat 6.7.2 version.

| 2019-11-25T22:05:42.769-0800 | ERROR | log/log.go:110 | Unexpected state reading from /hostfs/opt/caemm/amq/audit.log; error: read /hostfs/opt/caemm/amq/audit.log: cannot allocate memory |
| --- | --- | --- | --- |
| 2019-11-25T22:05:42.769-0800 | ERROR | log/harvester.go:282 | Read line error: read /hostfs/opt/caemm/amq/audit.log: cannot allocate memory; File: /hostfs/opt/caemm/amq/audit.log |
| 2019-11-25T22:05:42.770-0800 | ERROR | log/log.go:110 | Unexpected state reading from /hostfs/opt/caemm/scheduler/ca-sppevents.log; error: read /hostfs/opt/caemm/scheduler/ca-sppevents.log: cannot allocate memory |
| 2019-11-25T22:05:42.770-0800 | ERROR | log/harvester.go:282 | Read line error: read /hostfs/opt/caemm/scheduler/ca-sppevents.log: cannot allocate memory; File: /hostfs/opt/caemm/scheduler/ca-sppevents.log |
| 2019-11-25T22:05:42.861-0800 | ERROR | log/log.go:110 | Unexpected state reading from /hostfs/opt/caemm/readserver/tomeeLogs/localhost.2019-10-21.log; error: read /hostfs/opt/caemm/readserver/tomeeLogs/localhost.2019-10-21.log: cannot allocate memory |
| 2019-11-25T22:05:42.861-0800 | ERROR | log/harvester.go:282 | Read line error: read /hostfs/opt/caemm/readserver/tomeeLogs/localhost.2019-10-21.log: cannot allocate memory; File: /hostfs/opt/caemm/adminui/tomeeLogs/localhost.2019-10-21.log |

I have deployed 4 filebeats and 3 are running fine and one filebeat getting above errors while starting.

Could you any one help me how to resolve this issue.

Thanks,  
Sunil

---

<div class="post-metadata">

### Author: ![msunilreddy](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@msunilreddy](https://discuss.elastic.co/u/msunilreddy)
#### Post date: [November 26, 2019, 11:37am UTC](https://discuss.elastic.co/t/unexpected-state-reading-file-cannot-allocate-memory/209446/2 "2019-11-26T11:37:01Z")

</div>

Any idea how to resolve it ?

---

<div class="post-metadata">

### Author: ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [November 27, 2019, 3:59pm UTC](https://discuss.elastic.co/t/unexpected-state-reading-file-cannot-allocate-memory/209446/3 "2019-11-27T15:59:58Z")

</div>

Was there any problem on the output side? It is possible that there was backpressure, because ES or LS could not keep up with the load and Filebeat had to keep open many files thus the host run out of memory. Can you see anything in the logs of the output?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 25, 2019, 4:00pm UTC](https://discuss.elastic.co/t/unexpected-state-reading-file-cannot-allocate-memory/209446/4 "2019-12-25T16:00:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.